🤖 machine learning

ANVIL: Anomaly-based Vulnerability Identification without Labelled Training Data

The paper introduces ANVIL, an unsupervised vulnerability detection framework that leverages Large Language Models to identify code anomalies through masked reconstruction and a hybrid scoring mechanism, demonstrating superior performance over supervised detectors and successfully uncovering previously unknown vulnerabilities when integrated with fuzzers.

Original authors: Weizhou Wang, Eric Liu, Xiangyu Guo, Xiao Hu, Ilya Grishchenko, David Lie

Published 2026-06-30

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Weizhou Wang, Eric Liu, Xiangyu Guo, Xiao Hu, Ilya Grishchenko, David Lie

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to find a single, slightly broken brick in a massive wall made of millions of perfect bricks.

The Problem: The "Coin Flip" Dilemma
Usually, to find these broken bricks, you need a team of experts who have studied thousands of broken examples and learned exactly what they look like. This is how most current computer programs work: they are "supervised learners." But there's a huge problem: we don't have enough examples of broken code to teach them properly.

Recently, we have these super-smart AI models (called Large Language Models, or LLMs) that have read almost every piece of code ever written. You might think, "Great! They've seen everything, so they must be able to spot the broken bricks." But surprisingly, when you just ask them, "Is this line of code broken?" they perform no better than flipping a coin. They are great at writing code, but terrible at critiquing it, because they were trained to mimic patterns, not to spot errors.

The Solution: ANVIL (The "Spot the Difference" Game)
The researchers behind this paper, ANVIL, decided to flip the script. Instead of trying to teach the AI what a "broken" code looks like, they asked: "What does the AI think a normal line of code should look like?"

Here is how ANVIL works, using a simple analogy:

The Masking Game: Imagine you take a sentence from a story and cover up one line with a black marker. You then ask the AI to guess what that hidden line was, based only on the sentences before and after it.
The Expectation: If the hidden line is a normal, standard line of code, the AI will likely guess it correctly (or very close to it) because it has seen that pattern a million times.
The Anomaly: If the hidden line is a "vulnerable" (broken) line of code, it is likely weird or unusual compared to the rest of the training data. The AI will struggle to guess it. It might guess something totally different, or it will be very unsure.
The Score: ANVIL measures how much the AI's guess differs from the original line. If the guess is way off, or if the AI seems confused, ANVIL flags that line as "anomalous" (suspicious).

The "Hybrid" Detective
The researchers realized that just measuring the difference isn't enough. Sometimes a tiny difference (like changing > to >=) is a huge error, but the AI might not think it's a big deal. So, they created a "Hybrid Score" that acts like a detective with four different tools:

Exact Match: Did the AI get it 100% right? If not, that's a red flag.
Confusion Meter: How unsure was the AI? If the AI is hedging its bets, the code might be weird.
Complexity Check: Is the line of code overly complicated? Complex code is often where mistakes hide.
The "Loss" Score: A mathematical measure of how "surprised" the AI was by the original line.

The Results: Finding the Needle in the Haystack
The team tested ANVIL on a massive dataset of real-world code.

Beating the Experts: They compared ANVIL against the best existing tools that do require training data. Even though ANVIL didn't use any training data, it found vulnerabilities twice as accurately as the others.
The Context Trick: They found that giving the AI the whole file to read was actually confusing (like trying to find a needle in a haystack by looking at the whole barn). Instead, ANVIL uses a "smart context" approach: it only looks at the specific block of code (the function) surrounding the suspicious line. This made it faster and more accurate.
Real-World Success: To prove it works in the real world, they hooked ANVIL up to a "fuzzer" (a tool that tries to break software by throwing random data at it). ANVIL helped the fuzzer find two brand-new, previously unknown vulnerabilities, one of which was so serious it got an official security ID (CVE).

The Bottom Line
ANVIL proves that you don't need to teach an AI what "bad" looks like to find it. You just need to ask the AI what "normal" looks like. When the code doesn't fit the "normal" pattern, it's likely broken. It's a smarter, faster, and more general way to find security holes without needing a massive library of past mistakes to learn from.

Technical Summary: ANVIL – Anomaly-based Vulnerability Identification without Labelled Training Data

Problem Statement

Supervised-learning-based vulnerability detectors frequently underperform due to the scarcity of large, high-quality labelled training datasets. While Large Language Models (LLMs) are trained on vast unlabelled code corpora and excel at code generation, they perform poorly when directly prompted to detect vulnerabilities, often achieving accuracy no better than random chance. This limitation stems from the fact that LLMs are trained to generate code resembling their training distribution without explicit supervision on what constitutes "buggy" or "vulnerable" code. Consequently, they lack the domain-specific knowledge to distinguish vulnerable code from benign code. Furthermore, existing attempts to compensate for data shortages by generating synthetic vulnerabilities or selecting specific code features have yielded only modest improvements, as synthetic data fails to capture the diverse manifestations of real-world vulnerabilities.

Methodology

The paper introduces ANVIL, a line-level vulnerability localization approach that reframes vulnerability detection as an anomaly detection task. The core premise is that vulnerable code is rare and thus constitutes an anomaly relative to the distribution learned by LLMs during pre-training.

Core Workflow

Masked Code Reconstruction: For a given line of code under analysis, the original line is masked (removed). The LLM is then instructed to reconstruct this line based on the surrounding context.
Anomaly Scoring: The LLM-generated reconstruction is compared against the ground truth (the original line). Deviations are scored as anomalies. A high anomaly score indicates that the original line is "out-of-distribution" for the model, suggesting it is vulnerable.
Context Selection (Adaptive Context): To address the challenge of selecting appropriate context, ANVIL employs an Adaptive Context (AC) strategy. Instead of using a fixed window of lines, AC selects the largest compound statement (e.g., a function body) enclosing the masked line. This ensures the model receives semantically relevant context without the noise of unrelated code or the "lost-in-the-middle" issues associated with excessively long contexts.

Hybrid Anomaly Score

ANVIL proposes a hybrid anomaly score ( $\delta_{hybrid}$ ) that aggregates four distinct components to quantify the discrepancy between the generated and original code:

Cross-Entropy Loss ( $\delta_{loss}$ ): The average cross-entropy loss of the reconstructed line, measuring the probability of the generated tokens.
Exact Match Indicator ( $\delta_{EM}$ ): A binary metric that penalizes any deviation from the ground truth. If the generated line does not exactly match the original, it contributes to the anomaly score. This addresses the limitation of soft loss values, where minor but critical character differences (e.g., > vs >=) might otherwise be under-weighted.
First-Token Variance ( $\delta_{var}$ ): A measure of the model's confidence, calculated as the variance of the top-10 predicted tokens for the first generated position. Vulnerable lines tend to exhibit moderate variance, while benign lines often show high variance (clear completions) or low variance (hedging in simple contexts).
AST Complexity ( $\delta_{ast}$ ): A metric based on the number of nodes in the Abstract Syntax Tree (AST) of the original line. Higher complexity is associated with a higher risk of overlooked edge cases.

The final score is a normalized sum of these components, designed to reward exact matches while capturing subtle deviations, model uncertainty, and code complexity.

Key Contributions

ANVIL Framework: A novel, line-level vulnerability detection approach that requires no labelled training data, leveraging pre-trained LLMs to identify vulnerabilities as anomalies via masked reconstruction.
Hybrid Scoring Mechanism: The proposal and validation of a composite scoring function that combines loss, exact matching, confidence variance, and syntactic complexity, demonstrating that this combination outperforms individual metrics.
Adaptive Context Strategy: The introduction of a structure-aware context selection method that dynamically identifies the relevant compound statement, improving both detection accuracy and computational efficiency compared to fixed-size windows.
Comprehensive Evaluation: A rigorous evaluation across multiple LLM families, context sizes, and scoring methods, including a leakage-free evaluation on vulnerabilities disclosed after the LLM's training cutoff.

Experimental Results

The authors evaluated ANVIL on the PrimeVul dataset, a large-scale collection of open-source C/C++ projects, and compared it against state-of-the-art supervised detectors: LineVul, LineVD, and LLMAO.

Performance vs. Supervised Detectors: ANVIL significantly outperformed all supervised baselines.
- Top-3 Accuracy: ANVIL achieved up to 2× higher accuracy (31.3% vs. 17.3% for the best baseline).
- Normalized MFR: ANVIL showed a 75% improvement (0.18 vs. 0.39 for the best baseline).
- ROC-AUC: ANVIL achieved 61.8%, substantially higher than the baselines which hovered near random guessing (~50%).
Context and Scoring: The study confirmed that the hybrid scoring method and Adaptive Context yielded the best performance. Fixed context sizes below 100 lines resulted in degraded performance, while larger fixed sizes introduced noise and memory issues.
Generalization: ANVIL demonstrated strong generalization capabilities on a leakage-free dataset containing vulnerabilities disclosed after the LLM's training cutoff, proving its ability to detect unseen vulnerabilities without retraining.
Practical Utility: By integrating ANVIL with fuzzers to guide seed selection, the authors uncovered two previously unknown vulnerabilities, one of which was assigned a CVE, demonstrating the practical utility of anomaly-guided detection.

Significance

The paper claims that ANVIL offers a practical alternative to supervised learning for vulnerability detection by bypassing the bottleneck of labelled data. By leveraging the inherent "naturalness" of code learned by LLMs, ANVIL effectively isolates vulnerabilities at the line level. The results suggest that anomaly-based detection, particularly when enhanced with hybrid scoring and adaptive context, can outperform current supervised methods, especially in scenarios involving new or unseen codebases where training data is unavailable. The work highlights that while LLMs may not inherently "know" what a vulnerability is, they can effectively identify code that deviates from the statistical norms of correct code.